Gated sync refuses pm-web on an absolute-host-path finding the issue text does not contain, and the refusal hides the match #160

The scheduled gated sync in unbraind/pm-web has failed every day since about 2026-10-18 (run 39377821826, pm-github 2026.10.16). The privacy gate reports:

{"verdict":"fail","findings":[{"rule":"absolute-host-path","item_id":"github-issue-218","field":"body","hash":"71708eb2…"}]}

Neither issue #218's body nor its comments contain a host path such as /home, /tmp, /Users, /root, /var, /mnt, /opt or /srv. The only path-like text is GitHub blob/tree URLs (e.g. …/blob/pr-screenshots/brand/pm-web-triplicate/round4/revert-proofs) and one relative ./public/src/views/graph-canvas.js. That points to a false positive on a URL path segment, or on text the importer adds to the item body.

Expected:

1. The rule ignores path segments inside http(s):// URLs and ./-relative paths.
2. A finding names the matched character class and offset (or a redacted excerpt such as /h***/…), so a maintainer can see the cause without the secret.
3. A regression covers GitHub blob/tree URLs with deep paths.

Related: the closeout job in the same repo (run 39396497234) ends with the generic Closeout refused; check token read access to pull requests, checks and branch rules, and tracker close validation and no cause. It should name which of those checks failed.